# What Quick protects

Authority: code-truth as of 2026-08-09.

**A new site is private.** The bare URL admits nobody; the `?k=` link you hand over is what opens it. Nothing on
the box can be listed or enumerated by anyone without a session.

So publishing is the normal case. The user's work — docs, reports, designs, builds, dashboards, generated apps —
goes up, and you hand back the link. There is one thing to stop for, below.

## Never publish keys

Before you publish a folder, look at what is in it. Do not publish:

- API keys, tokens, passwords, connection strings, private keys, `.env` files
- credentials of any kind, including ones inside example code or config
- personal data about someone who has not agreed to it being shared

If you find any, say plainly what you found and where, and stop. Do not publish a redacted copy unless the user
asks for one. A share link is a bearer credential — anyone it reaches can read the site — so a key in a published
folder is a leaked key.

This is the one hard rule. Everything else is judgement.

## How access works

A site is `private` or `public`; a password, if set, overrides both.

| Site state | Who can read |
| --- | --- |
| `private` (the default for a new site) | an owner/member session, a share token (`?k=` or `x-oq-token`), or the password |
| `public` (the owner sets this deliberately) | anyone with the URL — safe `GET`/`HEAD` only |
| either, plus a password | password holders only |

Public never means writable. Leaving a comment always needs a credential, so nobody can write to a site just by
reaching it.

Admission is remembered in a signed cookie recording *which* credential let the holder in, re-checked on every
request. Revoke a token or change the password and it takes effect immediately.

Re-publishing keeps whatever visibility the site already had — only the first publish picks a default.

## Worth knowing

- Published pages run without a Content-Security-Policy, deliberately, so apps that load from a CDN work. In path
  routing mode all sites share one origin with the console, so script in a page you publish runs with the same
  privileges as the signed-in owner viewing it. Fine for your own work; worth a mention to the user if you are
  publishing HTML from somewhere else. Subdomain routing gives each site its own origin.
- Re-publishing replaces a site's content and keeps its URL. To retire one, `quick site delete <site> --force`
  makes its URL return 404; the files stay, so re-publishing the same name brings it back.
- A password is a view gate, not encryption — contents sit on the box's storage in the clear.
- Caps: 100 MiB total, 25 MiB per file, 2000 files, 120 requests per minute.

## What to tell the user

Call it **private — only people with the link can open it**. Offer `--password` if they want a second factor on
top of the link.